Thread: Vulnerability
View Single Post
  #2   (View Single Post)  
Old 20th March 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 5,944
Default

The PDF refers to (but does not cite) Loic Duflot's SMM abuse analysis from 2006. There was some discussion on misc@ at the time. This from Jonathan Thornburg nets out the consensus: (ref http://marc.info/?l=openbsd-misc&m=114658731227097&w=2)
Quote:
A brief perusal of [Duflot's] paper shows that it describes a way for the *superuser* to circumvent securelevel restrictions. This is interesting, but
(a) it describes an attack by a malicious *superuser*, and
(b) it describes an attack by a malicious person who *already* has an account on the machine under attack.
(a) in particular makes this of more academic than practical concern -- a malicious superuser has about 6.02e23 different ways to take over the system, so adding one more is of little interest. This "attack" is trivially preventable by not allowing malicious persons to become superuser in the first place, indeed by not giving them logins.
Duflot was scheduled to speak on SSM once again this week at CanSecWest, which ends today. Duflot has been harking on various security implications of the x86 SMM for some years.

My cursory interpretation -- I could be wrong -- is that the biggest area for concern, or at least awareness, for *nix users on this architecture is the use of XFree86 or X.Org, which exploit SMM. See xf86(4).

Last edited by jggimi; 20th March 2009 at 04:55 PM.
Reply With Quote